Executive brief
Znuny, an open-source help desk and ticketing system, is vulnerable to a security flaw where malicious code can be saved within a user's account settings. If an attacker successfully saves this code, it could execute in the browser of another user or administrator who views those settings. This could lead to unauthorized actions being performed on behalf of the victim or the theft of sensitive session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Znuny due to improper output encoding of user preferences stored in the database. An authenticated attacker with low privileges can inject malicious JavaScript into preference fields. When these values are subsequently rendered in the web interface for another user (such as an administrator), the script executes within the security context of that user's session. This is tracked as CWE-79 and requires the victim to view the affected preference page. The issue is resolved in Znuny LTS 6.5.21 and Znuny 7.3.3.
Affected products
- Znuny Znuny LTS 6.0, 6.1, 6.2, 6.3, 6.4, 6.5.1 through 6.5.20
- Znuny Znuny 7.0, 7.1, 7.2, 7.3.1 through 7.3.2
Timeline
- 2026-05-27: advisory: Vendor advisory ZSA-2026-11 released
- 2026-06-05: disclosed: CVE-2026-50591 published